CVE-2025-0451

CVE-2025-0451 describes an inappropriate implementation in the Extensions API of Google Chrome prior to version 133.0.6943.53. A remote attacker could induce a user to perform specific UI gestures, enabling UI spoofing via a crafted Chrome Extension. The core issue is in the Extensions API implem...

CVE-2025-0451

Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Medium...

Fedora 41 : chromium (2025-2525ddc3f2)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2525ddc3f2 advisory. Updated to 132.0.6834.159 Medium CVE-2025-0762: Use after free in DevTools Tenable has extracted the preceding description block directly from the...

Quorum onQ OS 6.0.0.5.2064 Cross Site Scripting

Quorum onQ OS version 6.0.0.5.2064 suffers from a cross site scripting vulnerability. + Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC + twitter.com/striv3r Vendor https://quorum.com/about/ Product Quorum onQ OS - 6.0.0.5.2064 Vulnerability Type Reflected Cross Site...

CVE-2025-0762

Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2025-0762

Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2025-0762

Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2025-0762

CVE-2025-0762 concerns Google Chrome/Chromium DevTools: a use-after-free in DevTools for builds prior to 132.0.6834.159, enabling potential heap corruption from a crafted Chrome Extension. Affected component is Chrome/Chromium DevTools; the underlying cause is a use-after-free defect (exact inter...

CVE-2025-0762

Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2025-0762

Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

Advisory ROSA-SA-2025-2662

software: openssh 9.5 OS: ROSA-CHROME packageevrstring: openssh-9.5 CVE-ID: CVE-2023-51385 BDU-ID: 2023-08955 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the SSH protocol implementation of the OpenSSH cryptographic security tool is related to the introduction or modification of an argument...

Advisory ROSA-SA-2025-2649

software: jasper 2.0.32 WASP: ROSA-CHROME packageevrstring: jasper-2.0.32 CVE-ID: CVE-2023-51257 BDU-ID: 2024-00902 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the jasimagedecode function of the JasPer library set's JPC encoder is related to an operation exceeding buffer boundaries in memory...

Advisory ROSA-SA-2025-2635

software: ncurses 6.2 WASP: ROSA-CHROME packageevrstring: ncurses-6.2 CVE-ID: CVE-2023-29491 BDU-ID: 2023-05772 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the ncurses terminal I/O control library is related to the ability to write beyond buffer boundaries in memory. Exploitation of the...

Advisory ROSA-SA-2025-2611

software: coreutils 8.32 OS: ROSA-CHROME packageevrstring: coreutils-8.32-5 CVE-ID: CVE-2024-0684 BDU-ID: 2024-00722 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the linebytessplit function src/split.c of the GNU Core Utilities GNU Coreutils suite of system utilities is related to a buffer...

Advisory ROSA-SA-2025-2579

software: suricata 6.0.20 WASP: ROSA-CHROME packageevrstring: suricata-6.0.20-2 CVE-ID: CVE-2024-45796 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Suricata allows an attacker to cause a failure in the reassembly of traffic fragments. CVE-STATUS: The vulnerability has been resolved...

Advisory ROSA-SA-2025-2576

software: xwayland 23.2.7 WASP: ROSA-CHROME packageevrstring: xwayland-23.2.7-1 CVE-ID: CVE-2024-9632 BDU-ID: 2024-09084 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the XkbSetCompatMap function of the X Window System X.Org Server implementation is related to a buffer overflow in dynamic memor...

Advisory ROSA-SA-2025-2570

software: php 7.4.33 WASP: ROSA-CHROME packageevrstring: php-7.4.33-11 CVE-ID: CVE-2022-4900 BDU-ID: 2023-02666 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the phpcliserverstartupworkers sapi/cli/phpcliserver.c function of the PHP programming language interpreter is related to an operation...

SpagoBI 3.5.1 Cross Site Request Forgery Vulnerability

CVE-2024-54792 Severity : Medium 6.1 CVSS score : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by CSRF in the admin panel that manages user grants. Poc The add/edit/delete user panel, accessible by the admin user, do n...

SpagoBI 3.5.1 Cross Site Scripting Vulnerability

CVE-2024-54795 Severity : Medium 5.4 CVSS score : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by multiple stored XSS inside of the worksheet designer page. Poc Steps to Reproduce : 1. While editing a document insertin...

SpagoBI 3.5.1 Cross Site Scripting

SpagoBI versions 3.5.1 and below suffer from persistent cross site scripting vulnerabilities. CVE-2024-54795 Severity : Medium 5.4 CVSS score : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by multiple stored XSS inside...